Tag Info

Hot answers tagged

256

This is actually an interesting new field in infosec - reputation management. Employers, Law Enforcement and other government agencies, legal professionals, the press, criminals and others with an interest in your reputation will be observing all online activity associated with your real name. These "interested parties" (snoops) are usually terrible at ...


123

The problem is heuristics. All mentioned tools are built on heuristics and the only way to avoid them is to change how you live completely. You can be fingerprinted by the modules installed in your browser. By the programs you use and the frequency you use them. These days you're going further than just online behavior. Shops know what you buy in what ...


83

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


57

As a very long time Tor user, the most surprising part of the NSA documents for me was how little progress they have made against Tor. Despite its known weaknesses, it's still the best thing we have, provided it's used properly and you make no mistakes. Since you want security of "the greatest degree technically feasible", I'm going to assume that your ...


55

Using your real name does not cause any harm to you. It is not true that you have to pay for any bad deed done by a bad person who misused your name. So, using your real name online is not a bad practise, it depends on your wish. But the information you share is the real key. Let us say that you have a blog or social network account with your real name. ...


52

My answer pokes at the original question. What makes you think that they don't get caught? The CIA and DoD found Osama bin Laden. Typical means include OSINT, TECHINT, and HUMINT. Forensics can be done on Tor. Secure deletion tools such as sdelete, BCWipe, and DBAN are not perfect. Encryption tools such as GPG and Truecrypt are not perfect. Online ...


50

I've researched this subject for more than 3 years*: Looking for VPN providers, reading through their Privacy Policy and Legal pages, contacting them, contacting their ISPs when possible, and I've concluded the following: I was able to find zero reputable/trustworthy and publicly-available (free or paid) VPN service provider that: Actually doesn't keep ...


48

You cannot enforce forgetfulness. The Web is like a big memory, and you cannot force it to forget everything about you(*). The only way, thus, is to change your identity so that everything the Web knows about you becomes stale. From a cryptographic point of view, this is the same case as with a secret value shared by members of a group: to evict a group ...


46

Using your real name is not only safe, it's important for you to do so. Just bear in mind that you don't want to simply attach your name to all your activities, you want to build and cultivate your online identity. Take the sad case of hapless, hopeless Rick Santorum. He was (and possibly still is) a politician with hopes for fame and power and sights on ...


43

TOR is better for you than it is for people in countries whose intelligence services run lots of TOR exit nodes and sniff the traffic. However, all you should assume when using TOR is that, if someone's not doing heavy statistical traffic analysis, they can't directly correlate your IP with the IP requesting resources at the server. That leaves many, many ...


43

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am really doing is linking my physical presence with the identity conferred to me by the state of which I am a national. A person may well have multiple identities. ...


36

From some experience with law enforcement and forensics, I can say one of the biggest issues is that ISPs really don't want to have to track users. Once they get beyond a certain level of management they lose 'common carrier' status and become liable for an awful lot of what their customers may do. Also, many countries do not want to pass on information to ...


35

I agree with one of the comments that one could write a book on this (I have an idea!) because this could get broad, but consider that these data mining tools (and I build them!) make some major assumptions. For instance, consider search history. One could easily build a program or a tool that would do "random" searches on topics where a person lacks ...


31

One real world example - when you are naked in your shower, not doing anything wrong, would you like it if everyone came by and took pictures? Or televised your shower for the world? Probably not. Another example - if I send a love letter, or write a will dividing up my savings, should that be published on the front page of the national papers? Again - no. ...


31

If you are in a crowd and you wear a mask, but nobody else in the crowd does, then you tend to attract attention... If you want to remain anonymous, then you must use only tools which do not single you out as a potential miscreant, i.e. tools that everybody uses. A good example is when you pay in cash: this is a mostly traceless payment system, and yet ...


27

One of the most important aspects of an attack like this is covering your tracks. There are lots of different ways to do this, as it depends on the technology. To address your specific questions: When they DDoS: If the flood was coming from their own machines, then it would be fairly easy to track them. The problem lies in the fact that they aren't using ...


24

You would also need to be careful of the fact that your ISP is in a position to see that 'your IP address' is using Tor, even though it can't tell what you're using Tor for. If conditions are so hostile that you could be brought under suspicion simply for appearing to be clandestine, then you should take care to use Tor everwhere except on an Internet ...


23

Sadly, whether or not to use your real name online may depend on your gender: One study found "that chat room participants with female usernames received 25 times more threatening and/or sexually explicit private messages than those with male or ambiguous usernames". There have been numerous cases of prominent female bloggers being harassed and ...


21

Source code consists in a bunch of text files. The contents of a text file are exactly what a text editor shows, so you can control that "visually". Beware of revision control systems such as CVS or Subversion: they can automatically replace some specific tags in source code (like "$Id$") with an identifying string which may contain the current date and ...


21

Personally, I use my real name online or one of a select few handles that are easily and fairly reliably identified to my real name with a simple Google search. I also have friends who will give me nothing but their handle even after we've been friends for years. There is no right or wrong answer, it really comes down to personal comfort with your online ...


21

All the answers posted here are awesome. But I would like to add a few points. When you start with removing your online prints : Make a list of all websites where you have accounts or which are linked to you in some way. One by one, remove your personal details, friends, etc. Add misinformation - new obscure data, new friends, new interests, anything else ...


20

There are a great many tweets, blog posts, articles, papers and books on this topic. Here are summaries of three of them in order of accessibility. First some quips in response to the classic question (from Schneier, see below for why these aren't the right answer though). "If I'm not doing anything wrong, then you have no cause to watch me." "Because the ...


19

Just because your traffic is passing though a proxy it doesn't mean you are safe. "Transparent" proxies will transmit your IP address using the X-Forwarded-For HTTP header. There are also cookies that can be used to identify you, such as flash's evercookie. You can even be fingerprinted and tracked by the extensions you have installed and what versions ...


19

As someone who has been heavily involved in one darknet (Anonet) and helped start another (Underlink, which is now mostly defunct), I will attempt to share my experiences and understanding of them here. Please feel free to edit this answer to provide additional details or to correct anything. Definition "Darknet" is a tricky word that has a few different ...


19

Most anonymizing services who claim that they "don't keep logs" actually do keep logs, because otherwise they would be in even deeper trouble when the Feds drop on them at 6:00 AM with terrorism charges. A VPN service like the ones you quote is basically saying: "yeah, we accept to take full legal responsibility for everything you do online for only 7$ per ...


18

In addition to the answers that have already been given, another reason it is so hard to catch anonymous is because anonymous can be anyone, literally. I mean this in two ways. First, hackers can use a combination of malware, spyware, and bots to access and use/loop through other peoples computers anywhere in the world; thus, making any computer, ...


17

TL;DR: Behave in the same way on the internet as you would in the street outside your house (probably) - be consistent about who you are (you shouldn't have to compromise on your core values), keep your clothes on, don't drive while drunk, don't walk up to a stranger and give them your pin number, take reasonable precautions to ensure your safety, never go ...


17

My take on this is that you have a couple of options: Entirely change your name, behaviour, appearance, your country, your friends etc so there is no correlation between data prior to the change and post-change. Like witness protection programmes, but with everything you do, not just your physical presence. Your buying habits have to change in department ...


17

Although you probably won't be able to delete what's already there, you could go through the other route: generate noise to cover the real information. Create several profiles with the same name or username you have been posting online and pretend to be interested in many fields. Do is progressively, so as not to be evident. This will work when it comes ...


17

Repeat the same process, but use a new prepaid phone number. If they can still guess who you are then it is freaky. If not, then it is probably your friends' contact lists which have been sucked up into Facebook. It would be an interesting exercise to try the same, but with your work number and see what kind of connections Facebook infers from that.



Only top voted, non community-wiki answers of a minimum length are eligible